https://blog.dansec.red/vendors/enocean/Recent content in EnOcean on DanSec DailyHugoen-gbFri, 01 May 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-05-01-cybersecurity-news/Fri, 01 May 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-05-01-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Hundreds of thousands of Roblox accounts were compromised through fake “game enhancements” that harvested login credentials, with stolen accounts subsequently sold for profit.</li> <li>90,000 screenshots, including private messages and photos, from a European celebrity’s smartphone were publicly exposed due to spyware, before being reported and taken down.</li> <li>A critical authentication bypass vulnerability (CVE-2026-41940) in cPanel, WHM, and WP Squared has been actively exploited as a zero-day since late February, granting attackers administrative access to servers. Proof-of-concept code is publicly available.</li> <li>Several npm packages for SAP’s cloud application ecosystem were compromised in a supply chain attack (“Mini Shai-Hulud”), impacting at least 1,800 downstream projects.</li> <li>The Lightning Python package and Intercom-client were compromised on PyPI, with malicious versions published to steal credentials. Combined, these packages have nearly 10 million monthly downloads.</li> <li>A Brazilian anti-DDoS firm was found to be enabling a botnet that conducted large-scale DDoS attacks against Brazilian ISPs.</li> <li>The FBI reported a sharp surge in cyber-enabled cargo theft attacks targeting transportation and logistics in the US and Canada, with losses exceeding $30 million in 2023.</li> <li>Law enforcement dismantled nine cryptocurrency investment scam centers, arresting 276 suspects in a joint operation involving US and Chinese authorities.</li> <li>PayPal email systems are being abused to distribute tech support scams by hijacking legitimate emails.</li> <li>Two former US ransomware negotiators were sentenced to four years in prison each for their role in facilitating BlackCat (ALPHV) ransomware attacks against US companies.</li> <li>The leader of an online swatting ring, responsible for targeting over 75 officials and institutions, was sentenced to four years in US federal prison.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>A high-severity local privilege escalation vulnerability (“Copy Fail”) in the Linux kernel, introduced in 2017, allows unprivileged local attackers to gain root access on major distributions. Exploit code is public and patches are available.</li> <li>Critical vulnerabilities in SonicWall firewalls could allow attackers to bypass security controls, access restricted services, or crash the devices. SonicWall has urged immediate patching.</li> <li>Two vulnerabilities in EnOcean SmartServer could allow security bypass and remote code execution on building management systems.</li> <li>A critical flaw in the Gemini CLI allowed attackers to execute arbitrary commands on the host via malicious configuration files, enabling supply chain attacks. The issue has been patched.</li> <li>The April 2026 KB5083769 Windows 11 update causes failures in third-party backup applications for versions 24H2 and 25H2.</li> <li>OpenEMR, a widely used open-source medical records system, was reported to have newly discovered vulnerabilities, though details remain limited.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Iran-linked hackers are targeting critical infrastructure sectors in the US.</li> <li>The TeamPCP threat group broadened its supply chain attacks, targeting npm packages used in SAP’s cloud development ecosystem.</li> <li>A sophisticated campaign distributing EtherRAT malware is spoofing administrative tools on GitHub to target high-privilege professional accounts.</li> <li>Threat actors compromised Lightning and Intercom-client Python packages to steal credentials in a coordinated supply chain attack.</li> <li>A new Python-based backdoor framework, DEEP#DOOR, was discovered. It leverages tunneling services for persistence and credential theft from browsers and cloud services.</li> <li>Criminals are using fake cell towers to send scam SMS messages at scale.</li> <li>A new phishing kit, Bluekit, offers more than 40 templates targeting popular services and integrates basic AI features to assist in campaign creation.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>AI is accelerating the speed and scale of cybercrime, with time-to-exploit for new vulnerabilities shrinking to hours. Attackers are increasingly automating scanning and exploitation of newly exposed assets.</li> <li>AI-assisted software scanning continues to identify longstanding vulnerabilities, with a recent scan uncovering a nine-year-old Linux bug.</li> <li>There is a growing use of AI in phishing operations, as demonstrated by the Bluekit phishing service.</li> <li>Attackers begin scanning and targeting new internet-facing assets within minutes of deployment, with compromise attempts occurring within the first 24 hours.</li> <li>Helpdesk impersonation scams are increasing, exploiting human factors in security.</li> <li>Abuse of legitimate communications platforms (such as PayPal emails) to deliver scams is ongoing.</li> <li>DDoS-for-hire services and botnet-enabled attacks remain prevalent, with some security firms implicated in facilitating these attacks.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>OpenAI has introduced an “Advanced Account Security” mode for at-risk ChatGPT and Codex accounts, aimed at mitigating phishing and account takeover risks.</li> <li>Anthropic launched “Claude Security” to help defenders respond to the increased risk of AI-powered exploits, particularly as its new AI model, Mythos, is expected to impact cybersecurity operations.</li> </ul>